@wowok/agent-mcp 3.4.3 → 3.4.4

package/dist/schemas/onchain_operations_order.schema.json

@@ -1,1121 +1 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://wowok.net/schemas/onchain_operations_order.json",
-  "title": "Order Operation",
-  "description": "📦 Order Object: Manage the order lifecycle, Including operating order arbitration (Arb Object associated with the order), advancing progress (Progress Object associated with the order), extracting order refunds/payments, setting agents, etc.",
-  "type": "object",
-  "properties": {
-    "operation_type": {
-      "type": "string",
-      "const": "order"
-    },
-    "data": {
-      "type": "object",
-      "properties": {
-        "object": {
-          "type": "string",
-          "description": "Order object ID or name."
-        },
-        "agent": {
-          "description": "Order agent. Agents can operate the order, such as canceling the order, modifying the order status, etc.; but cannot receive the funds received by the order.",
-          "anyOf": [
-            {
-              "description": "Array of account names, addresses, or mark names. Local marks are searched first for each entry. EXAMPLE: ['alice', '0x2...', 'bob']"
-            },
-            {
-              "type": "object",
-              "properties": {
-                "entities": {
-                  "minItems": 1,
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name_or_address": {
-                        "type": "string",
-                        "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                      },
-                      "local_mark_first": {
-                        "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                        "type": "boolean"
-                      }
-                    },
-                    "additionalProperties": false,
-                    "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                  }
-                },
-                "check_all_founded": {
-                  "default": true,
-                  "description": "Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)",
-                  "type": "boolean"
-                }
-              },
-              "required": [
-                "entities",
-                "check_all_founded"
-              ],
-              "additionalProperties": false,
-              "description": "Used to batch find account or object IDs by name"
-            }
-          ]
-        },
-        "required_info": {
-          "description": "Credential recorded on the order: the merchant's IM user address resolved from the Service's Contact (zero cost) or a WTS Proof object id (on-chain delivery proof embedding that IM address and timestamp; costs gas). The information itself is delivered via Wowok Messenger. ACCEPTED FORMS (upwc-cat-261017 T10 live probe): a Contact/Proof object ID (0x…), an account ADDRESS, or a REGISTERED mark name — a bare account display name is not an object reference and fails with 'not found'. WRITE PERMISSION: OWNER-ONLY — only the order owner (the buyer) can set or clear this field; any other signer (including the merchant/service owner) aborts on-chain (MoveAbort 1, 'Not the owner'). The merchant's role is to READ it and to receive the info over Messenger. ATTESTATION SEMANTICS: the recorded VALUE is self-attested and has no on-chain readback — never trust the value itself as a gate condition. A PRESENCE gate IS legitimate on-chain (query order.required_info is some — see pattern.required_info_evidence_gate): it proves the buyer recorded a credential before handover, without asserting what the credential says.",
-          "anyOf": [
-            {
-              "type": "string",
-              "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "required_info_bind": {
-          "description": "Bind a WTS Proof object as this order's required_info credential — the CONTROLLED alternative to required_info. OWNER-ONLY: the order owner (the buyer) signs; any other signer (including the merchant or an agent) aborts (E_NOT_THE_OWNER). The chain verifies the Proof is about THIS order AND was created by the order holder BEFORE writing, and freezes the Proof object on success — a Proof about another order or created by another account is refused (E_REQUIRED_INFO_PROOF_NOT_BOUND) with NOTHING written, closing the cross-order proof-reuse hole that plain required_info has. The sensitive payload itself (channel name, contact address, ...) stays off-chain inside the Proof — exchange/inspect it over Wowok Messenger. ACCEPTED FORMS: a Proof object ID (0x…) or a REGISTERED mark name. Mutually exclusive with required_info in one call (both entries write order.required_info).",
-          "type": "string"
-        },
-        "progress": {
-          "description": "Advance order process",
-          "type": "object",
-          "properties": {
-            "operation": {
-              "type": "object",
-              "properties": {
-                "next_node_name": {
-                  "type": "string",
-                  "description": "Next node name."
-                },
-                "forward": {
-                  "type": "string",
-                  "description": "Next forward name."
-                }
-              },
-              "required": [
-                "next_node_name",
-                "forward"
-              ],
-              "additionalProperties": false,
-              "description": "Specify a specific operation between current node and next node."
-            },
-            "op": {
-              "default": "next",
-              "description": "Operation type on the forward (CANONICAL form — prefer this). DEFAULT: 'next' when omitted. 'next' = advance the forward (accomplish); 'hold' = set hold to block the forward; 'unhold' = self-unhold, release own hold (no 224 permission needed); 'adminUnhold' = force-release hold via 224 permission (PROGRESS_UNHOLD). LEGACY ALIAS: `hold: boolean` is auto-converted to `op` — `hold:true`→`op:'hold'`, `hold:false`→`op:'next'`. New code should use `op` directly.",
-              "type": "string",
-              "enum": [
-                "next",
-                "hold",
-                "unhold",
-                "adminUnhold"
-              ]
-            },
-            "message": {
-              "description": "Message attached to the forward advance; recorded permanently in on-chain History. REVIEW-TYPE FORWARDS: de-facto REQUIRED here — the review text is this message (the reward claim guard does not read it, but a no-message Review forward has failed repeatedly on mainnet until the message was added). Always include message: '<review text>' when advancing a Review-named forward.",
-              "type": "string"
-            }
-          },
-          "required": [
-            "operation",
-            "op"
-          ],
-          "additionalProperties": false
-        },
-        "arb_confirm": {
-          "description": "CUSTOMER-side confirm on an Arb case (the order owner; the arbitration object's own confirm tool is the arbitrator's and rejects customers). Moves the case from state 0 to state 1. REQUIRED after an arbitrator reset — a reset returns the case to state 0 with the indemnity cleared, and only the customer can advance it again; the fee stays locked until this is called. Not the filing step: filing (dispute) lands the case directly in state 1.",
-          "type": "object",
-          "properties": {
-            "arb": {
-              "type": "string",
-              "description": "Arb object ID or name."
-            },
-            "confirm": {
-              "type": "boolean",
-              "description": "Whether to confirm that the submitted arbitration materials are valid for arbitration."
-            },
-            "description": {
-              "description": "Message description for compensation application.",
-              "type": "string"
-            },
-            "proposition": {
-              "description": "Compensation claims.",
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            }
-          },
-          "required": [
-            "arb",
-            "confirm"
-          ],
-          "additionalProperties": false
-        },
-        "arb_objection": {
-          "description": "Oppose and appeal the arbitration result, request re-arbitration.",
-          "type": "object",
-          "properties": {
-            "arb": {
-              "type": "string",
-              "description": "Arb object ID or name."
-            },
-            "objection": {
-              "type": "string",
-              "description": "Oppose and appeal the arbitration result, request re-arbitration"
-            }
-          },
-          "required": [
-            "arb",
-            "objection"
-          ],
-          "additionalProperties": false
-        },
-        "arb_claim_compensation": {
-          "description": "Specify the adjudicated Arb object to obtain order compensation. ZERO-INDEMNITY GATE (BF-14, chain abort 11): when the ruling's indemnity is 0 (a dismissal) the claim is REFUSED on-chain — the case stays open, the dispute fee stays escrowed (withdrawable by the arbitrator only after the 30-day window closes with no objection, or blocked while an objection is pending), and `order.claimed_by` is NOT written. A claim that DOES pay (indemnity > 0) closes the case (state 5), pays the claimant, writes `order.claimed_by`, and releases the fee path. DIRECTION (decision 11, TWO-RAIL INDEPENDENCE): `claimed_by` records only that a claim PAID or a dismissal was stamped — never WHO won. Order fund rails are NODE-GATED and NEVER read `claimed_by`; read ruling DIRECTION from `arb.indemnity.amount` (query 1641), never from `claimed_by`. F05 REVERSE GATE (yfd-ln-261024): when this order's escrow is ALREADY fully released (allocation balance 0 of a positive order amount), the claim is REFUSED unless acknowledge_dual_payout is true — pairing a paid compensation with a completed escrow track is a netting decision the operator must state (see acknowledge_dual_payout).",
-          "type": "object",
-          "properties": {
-            "arb": {
-              "type": "string",
-              "description": "Arb object ID or name."
-            }
-          },
-          "required": [
-            "arb"
-          ],
-          "additionalProperties": false
-        },
-        "acknowledge_dual_payout": {
-          "description": "Explicit opt-in for a KNOWN double payout on the compensation-claim direction (keeper posture 拍板⑧ dm-mtw-261027): when this order's escrow is already FULLY released (allocation balance 0 of a positive order amount) and this call claims the arbitration compensation on top, the call is REFUSED unless this flag is true. The escrow track and the compensation track are independent by design — the chain will not stop the second payout, so the operator must state the netting decision deliberately. Leave unset for claims on orders whose escrow is intact or partially released. AUTOMATION RULE: this flag is the HUMAN operator's netting decision — an automated keeper that receives dual_payout_unconfirmed must STOP retrying and escalate (never set the flag itself). D-1 (ksr 5R-08): the flag is additionally honored ONLY when the executing store carries a human-recorded preauthorization (config_operation store_dual_payout_set {account, confirm:true}, then store_dual_payout_get shows preauthorized=true); without it the gate answers dual_payout_preauthorization_required — record the standing decision first, then re-send.",
-          "type": "boolean"
-        },
-        "arb_case_conclude": {
-          "description": "DISMISSAL CONVERGER (F-BS-54/56, F-OF2-01): stamp a CONCLUDED ruling in the DISMISSAL direction onto this order through the service's case-conclusion entry so the case stops reading as open (dispute frozen, no later compensation claim can consume the zero award). PERMISSIONLESS: any keeper (merchant agent, watchdog, even the buyer) may drive it; it writes the claimed_by=case flag and MOVES NO FUNDS. DIRECTION FORK — the chain expresses a ruling direction ONLY as the indemnity it left behind. A case reads as DISMISSAL when its indemnity is none OR amount == 0 (defendant-favored): THIS is the only direction this call accepts — the chain refuses anything else (E_CASE_NOT_DISMISSAL_CONCLUSION, abort 48). A case whose ruling left indemnity > 0 = buyer-favored COMPENSATION: NEVER this call — that direction converges through the compensation claim (arb_claim_compensation) instead. Prerequisite: the arb case must already be CONCLUDED (status Arbitrated/Withdrawn — check arb_case_view first). On a LIVE case the dismissal reading deliberately reports true merely because no indemnity exists yet; that is NOT a ruling direction, so the concluded check always comes first. TYPICAL KEEPER LOOP after a 0-indemnity ruling: arb_claim_compensation aborts 11 (BF-14 zero-indemnity gate) → call THIS to stamp the dismissal → the escrow principal exits only through its node-gated fund rails (decision 11, TWO-RAIL INDEPENDENCE: fund rails read node state, never `claimed_by`).",
-          "type": "object",
-          "properties": {
-            "arb": {
-              "type": "string",
-              "description": "Arb object ID or name."
-            }
-          },
-          "required": [
-            "arb"
-          ],
-          "additionalProperties": false
-        },
-        "receive": {
-          "description": "Unwrap CoinWrapper objects or other objects received by the order and transfer them to the order owner. Consistent with `owner_receive` on other objects (arbitration/contact/demand/machine/permission/repository/reward/service/treasury).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.",
-          "anyOf": [
-            {
-              "type": "string",
-              "const": "recently"
-            },
-            {
-              "type": "string",
-              "pattern": "^0x[0-9a-fA-F]{8,}$"
-            },
-            {
-              "minItems": 1,
-              "type": "array",
-              "items": {
-                "type": "object",
-                "properties": {
-                  "id": {
-                    "type": "string",
-                    "minLength": 1,
-                    "description": "Received object ID"
-                  },
-                  "type": {
-                    "type": "string",
-                    "minLength": 1,
-                    "description": "Object type"
-                  },
-                  "content_raw": {
-                    "description": "Raw content data"
-                  },
-                  "version": {
-                    "description": "Object version, required to build a Receiving<T> argument for owner_receive",
-                    "type": "string"
-                  },
-                  "digest": {
-                    "description": "Object digest, required to build a Receiving<T> argument for owner_receive",
-                    "type": "string"
-                  }
-                },
-                "required": [
-                  "id",
-                  "type"
-                ],
-                "additionalProperties": false,
-                "description": "Received normal object record"
-              }
-            },
-            {
-              "type": "object",
-              "properties": {
-                "balance": {
-                  "anyOf": [
-                    {
-                      "type": "number"
-                    },
-                    {
-                      "type": "string"
-                    }
-                  ],
-                  "description": "A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."
-                },
-                "token_type": {
-                  "type": "string",
-                  "description": "Asset type of Coin objects. Supports CoinWrapper<...> format for order receive operations."
-                },
-                "received": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "id": {
-                        "type": "string",
-                        "description": "Received CoinWrapper object ID"
-                      },
-                      "balance": {
-                        "anyOf": [
-                          {
-                            "type": "number"
-                          },
-                          {
-                            "type": "string"
-                          }
-                        ],
-                        "description": "A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."
-                      },
-                      "payment": {
-                        "type": "string",
-                        "description": "Payment object ID"
-                      },
-                      "type": {
-                        "description": "Type of the received object (or inner coin type); used for token_type detection",
-                        "type": "string"
-                      },
-                      "version": {
-                        "description": "Object version, required to build a Receiving<T> argument for owner_receive",
-                        "type": "string"
-                      },
-                      "digest": {
-                        "description": "Object digest, required to build a Receiving<T> argument for owner_receive",
-                        "type": "string"
-                      }
-                    },
-                    "required": [
-                      "id",
-                      "balance",
-                      "payment"
-                    ],
-                    "additionalProperties": false,
-                    "description": "Received CoinWrapper object record"
-                  },
-                  "description": "Received records of Coin objects"
-                }
-              },
-              "required": [
-                "balance",
-                "token_type",
-                "received"
-              ],
-              "additionalProperties": false,
-              "description": "Received record of Coin objects"
-            }
-          ]
-        },
-        "transfer_to": {
-          "description": "Set new owner of the order. Requires order owner permission to set.",
-          "anyOf": [
-            {
-              "description": "Account name, address (0x...), or mark name. When using string format, local marks are searched first. EXAMPLE: 'alice' - searches local marks first, then global; EXAMPLE: '0x2...' (64 hex chars) - uses address directly; EXAMPLE: '' - uses the default local account"
-            },
-            {
-              "type": "object",
-              "properties": {
-                "name_or_address": {
-                  "type": "string",
-                  "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                },
-                "local_mark_first": {
-                  "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                  "type": "boolean"
-                }
-              },
-              "additionalProperties": false,
-              "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-            }
-          ]
-        },
-        "order_renew": {
-          "description": "Renewal in ONE transaction: pays into the order's allocation and advances the renew forward (fund + record + advance in a single step). Replaces the legacy 3-transaction renewal split. The new Payment's sole recipient is the allocation object itself (enforced on-chain). PRE-STATE CONSTRAINT (esound-mn-261021 B-1): guards on the advanced forward read the COMMITTED pre-transaction balance — this same-PTB payment is INVISIBLE to them; NEVER bind an allocation.balance gate to the forward this call advances (it always aborts; identity/signer guards are fine). If the forward DOES carry a balance gate, do NOT call this tool — execute the TWO-TX RENEW RECIPE (esound2-mn-261022 R2-1): a balance/fund-gated renew or capture forward is satisfiable only when the capture funds were committed in a PRIOR transaction — split the coupled one-PTB call into TWO transactions: TX1 commits the period/capture funds into the order's Allocation (create the escrowed payment record, then have the allocation receive it; a hand-built PTB until the allocation top-up primitive ships on the package face), WAIT for its success, then TX2 advances the forward with the plain order-holder progress call — the gate now reads the committed balance and passes. The ONE-PTB data.order_renew stays the route for GATE-LESS renew forwards only. NEVER retry the same-PTB shape after the abort: the guard verdict is structural (guards read the pre-transaction snapshot, esound-mn-261021 B-1), not a transient balance shortfall. Structural alternatives that avoid the second transaction: prepaid-full at buy (staged-RELEASE semantics) or per-period NEW Orders.",
-          "type": "object",
-          "properties": {
-            "allocation": {
-              "type": "string",
-              "description": "Allocation object ID or name receiving the renewal funds."
-            },
-            "type_parameter": {
-              "type": "string",
-              "description": "Coin type, e.g. \"0x2::wow::WOW\"."
-            },
-            "amount": {
-              "anyOf": [
-                {
-                  "type": "object",
-                  "properties": {
-                    "balance": {
-                      "anyOf": [
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "string"
-                        }
-                      ],
-                      "description": "A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."
-                    }
-                  },
-                  "required": [
-                    "balance"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Specify an amount value."
-                },
-                {
-                  "type": "object",
-                  "properties": {
-                    "coin": {
-                      "type": "string",
-                      "description": "Coin object ID or name(local mark). WHOLE-COIN TRANSFER: the ENTIRE Coin object is moved to the recipient — the 'amount' is NOT taken from it (testnet lesson: passing your main gas coin transfers its full balance, leaving you unable to pay for anything). Use only for coins whose whole balance is exactly what you intend to send; prefer {balance: <smallest-unit number>} for partial amounts."
-                    }
-                  },
-                  "required": [
-                    "coin"
-                  ],
-                  "additionalProperties": false
-                }
-              ],
-              "description": "Renewal payment."
-            },
-            "info": {
-              "type": "object",
-              "properties": {
-                "for_object": {
-                  "description": "Binding anchor for this distribution. On an Allocation a SET for_object is ENFORCED at alloc(): every GuardIdentifier recipient submission must equal this address or the whole tx aborts (ERECIPIENT_NOT_FOR_OBJECT, code 15) — verify the anchor matches the intended recipient flow BEFORE create; payment_info is immutable afterwards. NULL/omitted = no anchor: nothing is enforced on-chain, recipient routing is entirely the creator's design. Also recorded at creation for auditors to query the distribution's business context.",
-                  "anyOf": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ]
-                },
-                "for_guard": {
-                  "description": "Payment to satisfy verification of a Guard object",
-                  "anyOf": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ]
-                },
-                "remark": {
-                  "type": "string",
-                  "description": "Payment record remark"
-                },
-                "index": {
-                  "type": "integer",
-                  "minimum": 0,
-                  "maximum": 9007199254740991,
-                  "description": "Payment record index (non-negative integer)"
-                }
-              },
-              "required": [
-                "remark",
-                "index"
-              ],
-              "additionalProperties": false,
-              "description": "PaymentInfo for the new Payment object (remark/index, optional for_object/for_guard)."
-            },
-            "operation": {
-              "type": "object",
-              "properties": {
-                "next_node_name": {
-                  "type": "string",
-                  "description": "Next node name."
-                },
-                "forward": {
-                  "type": "string",
-                  "description": "Next forward name."
-                }
-              },
-              "required": [
-                "next_node_name",
-                "forward"
-              ],
-              "additionalProperties": false,
-              "description": "Renew forward to advance after the funding lands."
-            },
-            "message": {
-              "description": "Message attached to the forward advance.",
-              "type": "string"
-            }
-          },
-          "required": [
-            "allocation",
-            "type_parameter",
-            "amount",
-            "info",
-            "operation"
-          ],
-          "additionalProperties": false
-        }
-      },
-      "required": [
-        "object"
-      ],
-      "additionalProperties": false,
-      "description": "On-chain, operate on an Order object."
-    },
-    "idempotency_key": {
-      "type": "string",
-      "minLength": 8,
-      "maxLength": 128,
-      "pattern": "^[A-Za-z0-9._:-]+$",
-      "description": "F-RQ-13A (prescription ⑨): idempotency key for this business attempt. REPLAY GUARD: if a previous call with the SAME key is still open (dispatched but outcome unresolved, or already committed), this call is HELD — you get a structured state_conflict envelope with the prior attempt's verification data instead of a second on-chain submission (the ghost-order guard: two live mainnet orders, two escrows). Lifecycle: a deterministic failure (nothing submitted / provably reverted) clears the key — fix the cause and retry with the SAME key; an unknown-outcome failure (submission may have landed) keeps the key HELD — verify on-chain state first (result.submission_verification tells you where to look), and only retry with a NEW key once the outcome is resolved. Keep one key per business attempt (e.g. 'ord-20261030-042-buy'); do not reuse across attempts."
-    },
-    "env": {
-      "type": "object",
-      "properties": {
-        "account": {
-          "default": "",
-          "type": "string",
-          "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-        },
-        "permission_guard": {
-          "description": "List of permission guard IDs. Used to extend additional operation permissions (requires verification and configuration in the Permission object).",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "no_cache": {
-          "description": "Whether to disable caching.",
-          "type": "boolean"
-        },
-        "network": {
-          "description": "Omit in chat-client contexts — the runtime stamps the user's CURRENT network (the client's UI selection). Standalone MCP/CLI: omit to use the current network; set ONLY when the user explicitly names a different network (a mismatch pauses for user confirmation). Never guess or hardcode a network.",
-          "type": "string",
-          "enum": [
-            "localnet",
-            "testnet",
-            "mainnet"
-          ]
-        },
-        "referrer": {
-          "description": "Referrer ID. If the user is using the network for the first time, the referrer ID will be recorded (also applied when the SDK auto-registers the sender in the global Entity table).",
-          "type": "string"
-        },
-        "no_auto_register": {
-          "description": "Opt-out of SDK-level Entity auto-registration. By default, a business transaction whose sender has no entry in the global Entity table automatically appends an entity registration: the sender gets registered and receives an owned Resource object (their on-chain mark book) in the wallet. Set true ONLY when the user explicitly cancelled their entity registration or demands that the transaction not touch the Entity table.",
-          "type": "boolean"
-        },
-        "confirmed": {
-          "description": "Phase 2 ConfirmGate: set to true to proceed after a 'pending_confirmation' result. The operation is NOT executed until you re-call with confirmed=true after user consent.",
-          "type": "boolean"
-        },
-        "user_intent_phrases": {
-          "description": "Phase 2 ConfirmGate: explicit user intent phrases collected from conversation context (e.g. 'use default account', 'force publish'). Used to bypass confirmation rules whose bypass_on_explicit_intent matches.",
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        },
-        "plan_approval": {
-          "description": "K3 24 PlanApproval: id of a goal whose plan was approved via goal_operation action='approve'. When set: 1) the ConfirmGate treats fail-open rules (standard/none levels) as pre-approved for operations under this goal's plan; 2) after successful CREATION operations, the created objects are auto-registered into the goal (GoalRecord.objects + its TaskProcess manifest — ACT station 'execution registers'). Fail-closed levels (irreversible/publish/amount) still require per-operation confirmation with env.confirmed=true.",
-          "type": "string"
-        },
-        "client_schema_version": {
-          "description": "Client-side schema version (semver, e.g. '1.0.0'). When provided, the server checks compatibility and attaches warnings if mismatched.",
-          "type": "string"
-        },
-        "schema_strict_mode": {
-          "default": false,
-          "description": "When true, schema incompatibility returns an error instead of a warning. Default: false (warn mode).",
-          "type": "boolean"
-        },
-        "dry_run": {
-          "description": "Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).",
-          "type": "boolean"
-        },
-        "window_profile": {
-          "description": "Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).",
-          "type": "string",
-          "enum": [
-            "production",
-            "test"
-          ]
-        },
-        "response_level": {
-          "description": "Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.",
-          "type": "string",
-          "enum": [
-            "compact",
-            "full"
-          ]
-        },
-        "confirm_mode": {
-          "description": "Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.",
-          "type": "string",
-          "enum": [
-            "full",
-            "streamlined",
-            "quiet"
-          ]
-        }
-      },
-      "required": [
-        "account",
-        "schema_strict_mode"
-      ],
-      "additionalProperties": false,
-      "description": "IMPORTANT: Execution environment includes: account for signing operations, network selection (testnet | localnet | mainnet), additional Guard permissions, and more. Used to specify context information during the call. If account is not specified, the default account (\"\") will be used. NOTE: by default the SDK auto-registers the sender in the global Entity table when absent (first business transaction; the account receives an owned Resource object). Set no_auto_register=true only on explicit user request."
-    },
-    "submission": {
-      "type": "object",
-      "properties": {
-        "type": {
-          "type": "string",
-          "const": "submission",
-          "description": "Discriminator for this result variant. Constraint: always 'submission'. Example: 'submission'"
-        },
-        "guard": {
-          "maxItems": 20,
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "object": {
-                "type": "string",
-                "description": "Guard object name or ID to verify against. Example: 'my-delivery-guard' or '0x123...'"
-              },
-              "impack": {
-                "type": "boolean",
-                "description": "Whether this Guard's verification result participates in the final logic. Constraint: if false, the Guard is checked but does not block the operation. Example: true"
-              }
-            },
-            "required": [
-              "object",
-              "impack"
-            ],
-            "additionalProperties": false
-          },
-          "description": "Array of Guard objects to verify. Constraint: at most 20 entries (MAX_GUARD_COUNT_PASSPORT). Relation: each entry corresponds to a Guard bound to the operation."
-        },
-        "submission": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "properties": {
-              "guard": {
-                "type": "string",
-                "description": "Guard object name or ID that requires submission data. Example: 'my-delivery-guard'"
-              },
-              "submission": {
-                "type": "array",
-                "items": {
-                  "type": "object",
-                  "properties": {
-                    "identifier": {
-                      "type": "integer",
-                      "minimum": 0,
-                      "maximum": 255,
-                      "description": "Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."
-                    },
-                    "b_submission": {
-                      "type": "boolean",
-                      "description": "Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."
-                    },
-                    "value_type": {
-                      "description": "Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.",
-                      "anyOf": [
-                        {
-                          "type": "number",
-                          "const": 0,
-                          "description": "Bool (0)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 1,
-                          "description": "Address (1)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 2,
-                          "description": "String (2)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 3,
-                          "description": "U8 (3)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 4,
-                          "description": "U16 (4)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 5,
-                          "description": "U32 (5)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 6,
-                          "description": "U64 (6)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 7,
-                          "description": "U128 (7)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 8,
-                          "description": "U256 (8)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 9,
-                          "description": "VecBool (9)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 10,
-                          "description": "VecAddress (10)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 11,
-                          "description": "VecString (11)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 12,
-                          "description": "VecU8 (12)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 13,
-                          "description": "VecU16 (13)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 14,
-                          "description": "VecU32 (14)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 15,
-                          "description": "VecU64 (15)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 16,
-                          "description": "VecU128 (16)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 17,
-                          "description": "VecU256 (17)"
-                        },
-                        {
-                          "type": "number",
-                          "const": 18,
-                          "description": "VecVecU8 (18)"
-                        },
-                        {
-                          "type": "string",
-                          "const": "Bool",
-                          "description": "Bool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "Address",
-                          "description": "Address"
-                        },
-                        {
-                          "type": "string",
-                          "const": "String",
-                          "description": "String"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U8",
-                          "description": "U8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U16",
-                          "description": "U16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U32",
-                          "description": "U32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U64",
-                          "description": "U64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U128",
-                          "description": "U128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "U256",
-                          "description": "U256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecBool",
-                          "description": "VecBool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecAddress",
-                          "description": "VecAddress"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecString",
-                          "description": "VecString"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU8",
-                          "description": "VecU8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU16",
-                          "description": "VecU16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU32",
-                          "description": "VecU32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU64",
-                          "description": "VecU64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU128",
-                          "description": "VecU128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecU256",
-                          "description": "VecU256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "VecVecU8",
-                          "description": "VecVecU8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "bool",
-                          "description": "bool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "address",
-                          "description": "address"
-                        },
-                        {
-                          "type": "string",
-                          "const": "string",
-                          "description": "string"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u8",
-                          "description": "u8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u16",
-                          "description": "u16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u32",
-                          "description": "u32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u64",
-                          "description": "u64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u128",
-                          "description": "u128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "u256",
-                          "description": "u256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecbool",
-                          "description": "vecbool"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecaddress",
-                          "description": "vecaddress"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecstring",
-                          "description": "vecstring"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu8",
-                          "description": "vecu8"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu16",
-                          "description": "vecu16"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu32",
-                          "description": "vecu32"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu64",
-                          "description": "vecu64"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu128",
-                          "description": "vecu128"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecu256",
-                          "description": "vecu256"
-                        },
-                        {
-                          "type": "string",
-                          "const": "vecvecu8",
-                          "description": "vecvecu8"
-                        }
-                      ]
-                    },
-                    "value": {
-                      "description": "The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).",
-                      "anyOf": [
-                        {
-                          "type": "boolean"
-                        },
-                        {
-                          "anyOf": [
-                            {
-                              "type": "object",
-                              "properties": {
-                                "name_or_address": {
-                                  "type": "string",
-                                  "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                                },
-                                "local_mark_first": {
-                                  "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                                  "type": "boolean"
-                                }
-                              },
-                              "additionalProperties": false,
-                              "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                            },
-                            {
-                              "type": "string"
-                            }
-                          ]
-                        },
-                        {
-                          "type": "string"
-                        },
-                        {
-                          "type": "number"
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "boolean"
-                          }
-                        },
-                        {
-                          "anyOf": [
-                            {
-                              "type": "object",
-                              "properties": {
-                                "entities": {
-                                  "minItems": 1,
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "name_or_address": {
-                                        "type": "string",
-                                        "description": "Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."
-                                      },
-                                      "local_mark_first": {
-                                        "description": "Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks",
-                                        "type": "boolean"
-                                      }
-                                    },
-                                    "additionalProperties": false,
-                                    "description": "Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."
-                                  }
-                                },
-                                "check_all_founded": {
-                                  "default": true,
-                                  "description": "Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)",
-                                  "type": "boolean"
-                                }
-                              },
-                              "required": [
-                                "entities",
-                                "check_all_founded"
-                              ],
-                              "additionalProperties": false,
-                              "description": "Used to batch find account or object IDs by name"
-                            },
-                            {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              }
-                            }
-                          ]
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          }
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "number"
-                          }
-                        },
-                        {
-                          "type": "array",
-                          "items": {
-                            "type": "array",
-                            "items": {
-                              "type": "number"
-                            }
-                          }
-                        }
-                      ]
-                    },
-                    "name": {
-                      "default": "",
-                      "description": "Data name identifier. MAX 64 BCS characters (Chinese chars count as 3-4 BCS bytes each). Use short identifiers like 'order_id', 'delivery_node'. Put longer descriptions in the Guard's 'description' field, NOT here.",
-                      "type": "string"
-                    },
-                    "object_type": {
-                      "description": "OUTPUT-ONLY (query side): Object type when value_type is Address and represents a specific object. Auto-derived by the system — DO NOT set this field at Guard creation.",
-                      "type": "string",
-                      "enum": [
-                        "Permission",
-                        "Repository",
-                        "Arb",
-                        "Arbitration",
-                        "Service",
-                        "Machine",
-                        "Order",
-                        "Progress",
-                        "Payment",
-                        "Treasury",
-                        "Guard",
-                        "Demand",
-                        "Passport",
-                        "Allocation",
-                        "Resource",
-                        "Reward",
-                        "Discount",
-                        "EntityRegistrar",
-                        "EntityLinker",
-                        "Proof",
-                        "WReceivedObject",
-                        "Contact",
-                        "TableItem_ProgressHistory",
-                        "TableItem_PermissionPerm",
-                        "TableItem_DemandPresenter",
-                        "TableItem_MachineNode",
-                        "TableItem_TreasuryHistory",
-                        "TableItem_RepositoryData",
-                        "TableItem_RewardRecord",
-                        "TableItem_EntityLinker",
-                        "TableItem_AddressMark",
-                        "TableItem_EntityRegistrar"
-                      ]
-                    }
-                  },
-                  "required": [
-                    "identifier",
-                    "b_submission",
-                    "value_type",
-                    "name"
-                  ],
-                  "additionalProperties": false,
-                  "description": "Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"
-                },
-                "description": "User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."
-              }
-            },
-            "required": [
-              "guard",
-              "submission"
-            ],
-            "additionalProperties": false,
-            "description": "One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."
-          },
-          "description": "User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"
-        }
-      },
-      "required": [
-        "type",
-        "guard",
-        "submission"
-      ],
-      "additionalProperties": false,
-      "description": "Guard verification required. The operation was blocked because one or more Guards require user-submitted data. Fill the submission array and resubmit. Semantic status is 'pending_input'."
-    }
-  },
-  "required": [
-    "operation_type",
-    "data"
-  ],
-  "additionalProperties": false
-}
+{"$schema":"http://json-schema.org/draft-07/schema#","$id":"https://wowok.net/schemas/onchain_operations_order.json","title":"Order Operation","description":"📦 Order Object: Manage the order lifecycle, Including operating order arbitration (Arb Object associated with the order), advancing progress (Progress Object associated with the order), extracting order refunds/payments, setting agents, etc.","type":"object","properties":{"operation_type":{"type":"string","const":"order"},"data":{"type":"object","properties":{"object":{"type":"string","description":"Order object ID or name."},"agent":{"description":"Order agent. Agents can operate the order, such as canceling the order, modifying the order status, etc.; but cannot receive the funds received by the order.","anyOf":[{"description":"Array of account names, addresses, or mark names. Local marks are searched first for each entry. EXAMPLE: ['alice', '0x2...', 'bob']"},{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"}]},"required_info":{"description":"Credential recorded on the order: the merchant's IM user address resolved from the Service's Contact (zero cost) or a WTS Proof object id (on-chain delivery proof embedding that IM address and timestamp; costs gas). The information itself is delivered via Wowok Messenger. ACCEPTED FORMS (upwc-cat-261017 T10 live probe): a Contact/Proof object ID (0x…), an account ADDRESS, or a REGISTERED mark name — a bare account display name is not an object reference and fails with 'not found'. WRITE PERMISSION: OWNER-ONLY — only the order owner (the buyer) can set or clear this field; any other signer (including the merchant/service owner) aborts on-chain (MoveAbort 1, 'Not the owner'). The merchant's role is to READ it and to receive the info over Messenger. ATTESTATION SEMANTICS: the recorded VALUE is self-attested and has no on-chain readback — never trust the value itself as a gate condition. A PRESENCE gate IS legitimate on-chain (query order.required_info is some — see pattern.required_info_evidence_gate): it proves the buyer recorded a credential before handover, without asserting what the credential says.","anyOf":[{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},{"type":"null"}]},"required_info_bind":{"description":"Bind a WTS Proof object as this order's required_info credential — the CONTROLLED alternative to required_info. OWNER-ONLY: the order owner (the buyer) signs; any other signer (including the merchant or an agent) aborts (E_NOT_THE_OWNER). The chain verifies the Proof is about THIS order AND was created by the order holder BEFORE writing, and freezes the Proof object on success — a Proof about another order or created by another account is refused (E_REQUIRED_INFO_PROOF_NOT_BOUND) with NOTHING written, closing the cross-order proof-reuse hole that plain required_info has. The sensitive payload itself (channel name, contact address, ...) stays off-chain inside the Proof — exchange/inspect it over Wowok Messenger. ACCEPTED FORMS: a Proof object ID (0x…) or a REGISTERED mark name. Mutually exclusive with required_info in one call (both entries write order.required_info).","type":"string"},"progress":{"description":"Advance order process","type":"object","properties":{"operation":{"type":"object","properties":{"next_node_name":{"type":"string","description":"Next node name."},"forward":{"type":"string","description":"Next forward name."}},"required":["next_node_name","forward"],"additionalProperties":false,"description":"Specify a specific operation between current node and next node."},"op":{"default":"next","description":"Operation type on the forward (CANONICAL form — prefer this). DEFAULT: 'next' when omitted. 'next' = advance the forward (accomplish); 'hold' = set hold to block the forward; 'unhold' = self-unhold, release own hold (no 224 permission needed); 'adminUnhold' = force-release hold via 224 permission (PROGRESS_UNHOLD). LEGACY ALIAS: `hold: boolean` is auto-converted to `op` — `hold:true`→`op:'hold'`, `hold:false`→`op:'next'`. New code should use `op` directly.","type":"string","enum":["next","hold","unhold","adminUnhold"]},"scope":{"description":"Drive scope of the forward. DEFAULT 'order': resolve the Progress's task-bound Order and advance via the order-scoped advance/hold entry points (payer authority enforced, zombie shield active — a principal-refunded order aborts 15 BEFORE guard evaluation). 'generic': do NOT bind the order — advance via the generic advance / hold entries (the progress package's shared implementation, order=false): NO zombie check, guard + task binding + permission still verified. REQUIRED (the only working spelling) when re-driving a refund-latch convergence edge — e.g. the compiled ConvergeRefunded forward whose guard reads order.principal_refunded — AFTER the refund has settled: order-scoped, that edge's guard being true is exactly the zombie shield's abort condition, so every order-scoped attempt dies with abort E_ORDER_PRINCIPAL_REFUNDED regardless of who signs. Incompatible with contribute (the contribution row id IS the bound order address).","type":"string","enum":["order","generic"]},"message":{"description":"Message attached to the forward advance; recorded permanently in on-chain History. REVIEW-TYPE FORWARDS: de-facto REQUIRED here — the review text is this message (the reward claim guard does not read it, but a no-message Review forward has failed repeatedly on mainnet until the message was added). Always include message: '<review text>' when advancing a Review-named forward.","type":"string"},"contribute":{"description":"Goal ledger Repository (ID or name) for the BUILTIN CONTRIBUTION rail — valid ONLY with op:'next' and ONLY with a task-bound Progress (the contribution row id IS the bound Order address; value = order amount; idempotent — an existing row is never overwritten; author = none). In one atomic tx the kernel writes the row THEN advances the edge (an aborting edge aborts the row with it). Requirements: the ledger MUST be one of the Progress's context repositories (abort 16 E_REPO_NOT_CONTEXT); the Order must not be fully refunded (abort 15); BOTH a passport submission and the bound Order are mandatory (no bare variant); the ledger owner must have armed a contribution spec (repository builtin_spec: key + threshold over a U256/id_from-none policy — repository aborts 25/26). Reaching the threshold latches a monotonic GoalStamp (GoalReachedEvent) that saturates guard queries 1179/1181.","type":"string"}},"required":["operation","op"],"additionalProperties":false},"arb_confirm":{"description":"CUSTOMER-side confirm on an Arb case (the order owner; the arbitration object's own confirm tool is the arbitrator's and rejects customers). Moves the case from state 0 to state 1. REQUIRED after an arbitrator reset — a reset returns the case to state 0 with the indemnity cleared, and only the customer can advance it again; the fee stays locked until this is called. Not the filing step: filing (dispute) lands the case directly in state 1.","type":"object","properties":{"arb":{"type":"string","description":"Arb object ID or name."},"confirm":{"type":"boolean","description":"Whether to confirm that the submitted arbitration materials are valid for arbitration."},"description":{"description":"Message description for compensation application.","type":"string"},"proposition":{"description":"Compensation claims.","type":"array","items":{"type":"string"}}},"required":["arb","confirm"],"additionalProperties":false},"arb_objection":{"description":"Oppose and appeal the arbitration result, request re-arbitration.","type":"object","properties":{"arb":{"type":"string","description":"Arb object ID or name."},"objection":{"type":"string","description":"Oppose and appeal the arbitration result, request re-arbitration"}},"required":["arb","objection"],"additionalProperties":false},"arb_claim_compensation":{"description":"Specify the adjudicated Arb object to obtain order compensation. ZERO-INDEMNITY GATE (BF-14, chain abort 11): when the ruling's indemnity is 0 (a dismissal) the claim is REFUSED on-chain — the case stays open, the dispute fee stays escrowed (withdrawable by the arbitrator only after the 30-day window closes with no objection, or blocked while an objection is pending), and `order.claimed_by` is NOT written. A claim that DOES pay (indemnity > 0) closes the case (state 5), pays the claimant, writes `order.claimed_by`, and releases the fee path. DIRECTION (decision 11, TWO-RAIL INDEPENDENCE): `claimed_by` records only that a claim PAID or a dismissal was stamped — never WHO won. Order fund rails are NODE-GATED and NEVER read `claimed_by`; read ruling DIRECTION from `arb.indemnity.amount` (query 1641), never from `claimed_by`. F05 REVERSE GATE (yfd-ln-261024): when this order's escrow is ALREADY fully released (allocation balance 0 of a positive order amount), the claim is REFUSED unless acknowledge_dual_payout is true — pairing a paid compensation with a completed escrow track is a netting decision the operator must state (see acknowledge_dual_payout).","type":"object","properties":{"arb":{"type":"string","description":"Arb object ID or name."}},"required":["arb"],"additionalProperties":false},"acknowledge_dual_payout":{"description":"Explicit opt-in for a KNOWN double payout on the compensation-claim direction (keeper posture 拍板⑧ dm-mtw-261027): when this order's escrow is already FULLY released (allocation balance 0 of a positive order amount) and this call claims the arbitration compensation on top, the call is REFUSED unless this flag is true. The escrow track and the compensation track are independent by design — the chain will not stop the second payout, so the operator must state the netting decision deliberately. Leave unset for claims on orders whose escrow is intact or partially released. AUTOMATION RULE: this flag is the HUMAN operator's netting decision — an automated keeper that receives dual_payout_unconfirmed must STOP retrying and escalate (never set the flag itself). D-1 (ksr 5R-08): the flag is additionally honored ONLY when the executing store carries a human-recorded preauthorization (config_operation store_dual_payout_set {account, confirm:true}, then store_dual_payout_get shows preauthorized=true); without it the gate answers dual_payout_preauthorization_required — record the standing decision first, then re-send.","type":"boolean"},"arb_case_conclude":{"description":"DISMISSAL CONVERGER (F-BS-54/56, F-OF2-01): stamp a CONCLUDED ruling in the DISMISSAL direction onto this order through the service's case-conclusion entry so the case stops reading as open (dispute frozen, no later compensation claim can consume the zero award). PERMISSIONLESS: any keeper (merchant agent, watchdog, even the buyer) may drive it; it writes the claimed_by=case flag and MOVES NO FUNDS. DIRECTION FORK — the chain expresses a ruling direction ONLY as the indemnity it left behind. A case reads as DISMISSAL when its indemnity is none OR amount == 0 (defendant-favored): THIS is the only direction this call accepts — the chain refuses anything else (E_CASE_NOT_DISMISSAL_CONCLUSION, abort 48). A case whose ruling left indemnity > 0 = buyer-favored COMPENSATION: NEVER this call — that direction converges through the compensation claim (arb_claim_compensation) instead. Prerequisite: the arb case must already be CONCLUDED (status Arbitrated/Withdrawn — check arb_case_view first). On a LIVE case the dismissal reading deliberately reports true merely because no indemnity exists yet; that is NOT a ruling direction, so the concluded check always comes first. TYPICAL KEEPER LOOP after a 0-indemnity ruling: arb_claim_compensation aborts 11 (BF-14 zero-indemnity gate) → call THIS to stamp the dismissal → the escrow principal exits only through its node-gated fund rails (decision 11, TWO-RAIL INDEPENDENCE: fund rails read node state, never `claimed_by`).","type":"object","properties":{"arb":{"type":"string","description":"Arb object ID or name."}},"required":["arb"],"additionalProperties":false},"receive":{"description":"Unwrap CoinWrapper objects or other objects received by the order and transfer them to the order owner. Consistent with `owner_receive` on other objects (arbitration/contact/demand/machine/permission/repository/reward/service/treasury).\n\nACCEPTED FORMATS (F-06 unified receive operation block):\n• 'recently' (string literal) — auto-query and receive ALL recently received objects.\n  Use this for the common case: \"withdraw everything the object has received\" — for\n  order.receive this is the correct default for \"the buyer got their refund\".\n  Example: receive: 'recently'\n• bare object id (string, 0x-prefixed) — one-object form, auto-expanded (F-15):\n  pass the id of the single received object you want to unwrap (e.g. a CoinWrapper id).\n  Example: receive: '0xabc...'\n• ReceivedNormal[] (array) — explicit list of received objects to unwrap.\n  Use this when you want to receive specific objects only (not all).\n  Example: receive: [{id: '0xobj1', type: '0x2::coin::Coin<0x2::wow::WOW>'}]\n• ReceivedBalance ({token_type, balance, received: [{id, balance, payment}]}) —\n  receive a balance record from a specific Payment/payer.\n  Use this for precise balance targeting (advanced — usually after querying\n  the object's received history via query_received).\n  Example: receive: {token_type: '0x2::wow::WOW', balance: 1000000, received: [{id: '0xrec1', balance: 1000000, payment: '0xpay1'}]}\nANTI-PATTERN: do NOT wrap in {result: ...} — pass the value directly.","anyOf":[{"type":"string","const":"recently"},{"type":"string","pattern":"^0x[0-9a-fA-F]{8,}$"},{"minItems":1,"type":"array","items":{"type":"object","properties":{"id":{"type":"string","minLength":1,"description":"Received object ID"},"type":{"type":"string","minLength":1,"description":"Object type"},"content_raw":{"description":"Raw content data"},"version":{"description":"Object version, required to build a Receiving<T> argument for owner_receive","type":"string"},"digest":{"description":"Object digest, required to build a Receiving<T> argument for owner_receive","type":"string"}},"required":["id","type"],"additionalProperties":false,"description":"Received normal object record"}},{"type":"object","properties":{"balance":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."},"token_type":{"type":"string","description":"Asset type of Coin objects. Supports CoinWrapper<...> format for order receive operations."},"received":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Received CoinWrapper object ID"},"balance":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."},"payment":{"type":"string","description":"Payment object ID"},"type":{"description":"Type of the received object (or inner coin type); used for token_type detection","type":"string"},"version":{"description":"Object version, required to build a Receiving<T> argument for owner_receive","type":"string"},"digest":{"description":"Object digest, required to build a Receiving<T> argument for owner_receive","type":"string"}},"required":["id","balance","payment"],"additionalProperties":false,"description":"Received CoinWrapper object record"},"description":"Received records of Coin objects"}},"required":["balance","token_type","received"],"additionalProperties":false,"description":"Received record of Coin objects"}]},"transfer_to":{"description":"Set new owner of the order. Requires order owner permission to set.","anyOf":[{"description":"Account name, address (0x...), or mark name. When using string format, local marks are searched first. EXAMPLE: 'alice' - searches local marks first, then global; EXAMPLE: '0x2...' (64 hex chars) - uses address directly; EXAMPLE: '' - uses the default local account"},{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}]},"order_renew":{"description":"Renewal in ONE transaction: pays into the order's allocation and advances the renew forward (fund + record + advance in a single step). Replaces the legacy 3-transaction renewal split. The new Payment's sole recipient is the allocation object itself (enforced on-chain). PRE-STATE CONSTRAINT (esound-mn-261021 B-1): guards on the advanced forward read the COMMITTED pre-transaction balance — this same-PTB payment is INVISIBLE to them; NEVER bind an allocation.balance gate to the forward this call advances (it always aborts; identity/signer guards are fine). If the forward DOES carry a balance gate, do NOT call this tool — execute the TWO-TX RENEW RECIPE (esound2-mn-261022 R2-1): a balance/fund-gated renew or capture forward is satisfiable only when the capture funds were committed in a PRIOR transaction — split the coupled one-PTB call into TWO transactions: TX1 commits the period/capture funds into the order's Allocation (create the escrowed payment record, then have the allocation receive it; a hand-built PTB until the allocation top-up primitive ships on the package face), WAIT for its success, then TX2 advances the forward with the plain order-holder progress call — the gate now reads the committed balance and passes. The ONE-PTB data.order_renew stays the route for GATE-LESS renew forwards only. NEVER retry the same-PTB shape after the abort: the guard verdict is structural (guards read the pre-transaction snapshot, esound-mn-261021 B-1), not a transient balance shortfall. Structural alternatives that avoid the second transaction: prepaid-full at buy (staged-RELEASE semantics) or per-period NEW Orders.","type":"object","properties":{"allocation":{"type":"string","description":"Allocation object ID or name receiving the renewal funds."},"type_parameter":{"type":"string","description":"Coin type, e.g. \"0x2::wow::WOW\"."},"amount":{"anyOf":[{"type":"object","properties":{"balance":{"anyOf":[{"type":"number"},{"type":"string"}],"description":"A coin/balance amount. Accepts three formats: (1) DISPLAY FORMAT with token symbol: \"2.5WOW\", \"10USDC\", \"0.05WOW\" — auto-converted to smallest units via the Fund Processing Layer (token precision resolved from official registry → cache → on-chain). The symbol MUST match the token's type_parameter. (2) SMALLEST UNIT (numeric string): \"10000000000\" — used as-is, no conversion. (3) SMALLEST UNIT (number): 10000000000 — used as-is only within the safe integer range (±2^53); numbers outside it are REJECTED, use a numeric string instead. PRECISION RULE: for values exceeding 2^53 (9007199254740991), ALWAYS use format (1) or (2) — JS numbers lose integer precision silently and such inputs are blocked. Raw amounts must be plain non-negative integers; a decimal value without a token symbol (e.g. \"2.5\") is rejected — append the symbol (\"2.5WOW\") so the Fund Processing Layer converts it. WARNING — BARE INTEGER MEANS SMALLEST UNIT, NOT TOKENS: formats (2)/(3) are NEVER interpreted as display tokens. For example amount=\"5\" or 5 means 5 raw units = 0.000000005 WOW (9 decimals) — NOT 5 WOW. When the user asks for a token amount, you MUST use display format (\"5WOW\", \"2USDC\"); a bare integer is only correct for unitless counts (e.g. stock quantity) or when you computed exact raw units yourself. Default token: WOW (9 decimals, 1 WOW = 10^9 MIST). For custom tokens: use display format with the token's symbol, or pass smallest units directly. MONEY CONFIRMATION: all monetary fields trigger user confirmation via the Fund Processing Layer, where the token's FULL type, decimals and raw amount are always visible. MULTIPLE ISSUERS: several on-chain tokens may legally share the same symbol (e.g. multiple \"USDT\" coins). When a bare symbol matches more than one token, the operation is BLOCKED and every candidate is listed with full details (type, name, decimals, verified tag) — present the list to the USER and let them choose (they may answer by number), then re-issue with the chosen token's FULL type string in type_parameter; never guess an issuer from the bare symbol. MISSING TOKEN INFO: when a token's precision cannot be resolved, the operation is REFUSED (raw u64 included — amount magnitude could not be verified). Recovery: provide the token's FULL type in package::module::Name form in type_parameter (a bare symbol like \"USDT\" cannot be resolved), and verify the WOW network is correct. Examples: \"2.5WOW\" (display → 2500000000), 10000000000 (number, smallest unit), \"50000000000\" (string, smallest unit). Used for: service sale prices, compensation fund balances, Treasury deposits, arbitration fees, reward amounts, stock quantities."}},"required":["balance"],"additionalProperties":false,"description":"Specify an amount value."},{"type":"object","properties":{"coin":{"type":"string","description":"Coin object ID or name(local mark). WHOLE-COIN TRANSFER: the ENTIRE Coin object is moved to the recipient — the 'amount' is NOT taken from it (testnet lesson: passing your main gas coin transfers its full balance, leaving you unable to pay for anything). Use only for coins whose whole balance is exactly what you intend to send; prefer {balance: <smallest-unit number>} for partial amounts."}},"required":["coin"],"additionalProperties":false}],"description":"Renewal payment."},"info":{"type":"object","properties":{"for_object":{"description":"Binding anchor for this distribution. On an Allocation a SET for_object is ENFORCED at alloc(): every GuardIdentifier recipient submission must equal this address or the whole tx aborts (ERECIPIENT_NOT_FOR_OBJECT, code 15) — verify the anchor matches the intended recipient flow BEFORE create; payment_info is immutable afterwards. NULL/omitted = no anchor: nothing is enforced on-chain, recipient routing is entirely the creator's design. Also recorded at creation for auditors to query the distribution's business context.","anyOf":[{"type":"string"},{"type":"null"}]},"for_guard":{"description":"Payment to satisfy verification of a Guard object","anyOf":[{"type":"string"},{"type":"null"}]},"remark":{"type":"string","description":"Payment record remark"},"index":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"Payment record index (non-negative integer)"}},"required":["remark","index"],"additionalProperties":false,"description":"PaymentInfo for the new Payment object (remark/index, optional for_object/for_guard)."},"operation":{"type":"object","properties":{"next_node_name":{"type":"string","description":"Next node name."},"forward":{"type":"string","description":"Next forward name."}},"required":["next_node_name","forward"],"additionalProperties":false,"description":"Renew forward to advance after the funding lands."},"message":{"description":"Message attached to the forward advance.","type":"string"}},"required":["allocation","type_parameter","amount","info","operation"],"additionalProperties":false}},"required":["object"],"additionalProperties":false,"description":"On-chain, operate on an Order object."},"idempotency_key":{"type":"string","minLength":8,"maxLength":128,"pattern":"^[A-Za-z0-9._:-]+$","description":"F-RQ-13A (prescription ⑨): idempotency key for this business attempt. REPLAY GUARD: if a previous call with the SAME key is still open (dispatched but outcome unresolved, or already committed), this call is HELD — you get a structured state_conflict envelope with the prior attempt's verification data instead of a second on-chain submission (the ghost-order guard: two live mainnet orders, two escrows). Lifecycle: a deterministic failure (nothing submitted / provably reverted) clears the key — fix the cause and retry with the SAME key; an unknown-outcome failure (submission may have landed) keeps the key HELD — verify on-chain state first (result.submission_verification tells you where to look), and only retry with a NEW key once the outcome is resolved. Keep one key per business attempt (e.g. 'ord-20261030-042-buy'); do not reuse across attempts."},"env":{"type":"object","properties":{"account":{"default":"","type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"permission_guard":{"description":"List of permission guard IDs. Used to extend additional operation permissions (requires verification and configuration in the Permission object).","type":"array","items":{"type":"string"}},"no_cache":{"description":"Whether to disable caching.","type":"boolean"},"network":{"description":"Omit in chat-client contexts — the runtime stamps the user's CURRENT network (the client's UI selection). Standalone MCP/CLI: omit to use the current network; set ONLY when the user explicitly names a different network (a mismatch pauses for user confirmation). Never guess or hardcode a network.","type":"string","enum":["localnet","testnet","mainnet"]},"referrer":{"description":"Referrer ID. If the user is using the network for the first time, the referrer ID will be recorded (also applied when the SDK auto-registers the sender in the global Entity table).","type":"string"},"no_auto_register":{"description":"Opt-out of SDK-level Entity auto-registration. By default, a business transaction whose sender has no entry in the global Entity table automatically appends an entity registration: the sender gets registered and receives an owned Resource object (their on-chain mark book) in the wallet. Set true ONLY when the user explicitly cancelled their entity registration or demands that the transaction not touch the Entity table.","type":"boolean"},"confirmed":{"description":"Phase 2 ConfirmGate: set to true to proceed after a 'pending_confirmation' result. The operation is NOT executed until you re-call with confirmed=true after user consent.","type":"boolean"},"user_intent_phrases":{"description":"Phase 2 ConfirmGate: explicit user intent phrases collected from conversation context (e.g. 'use default account', 'force publish'). Used to bypass confirmation rules whose bypass_on_explicit_intent matches.","type":"array","items":{"type":"string"}},"plan_approval":{"description":"K3 24 PlanApproval: id of a goal whose plan was approved via goal_operation action='approve'. When set: 1) the ConfirmGate treats fail-open rules (standard/none levels) as pre-approved for operations under this goal's plan; 2) after successful CREATION operations, the created objects are auto-registered into the goal (GoalRecord.objects + its TaskProcess manifest — ACT station 'execution registers'). Fail-closed levels (irreversible/publish/amount) still require per-operation confirmation with env.confirmed=true.","type":"string"},"client_schema_version":{"description":"Client-side schema version (semver, e.g. '1.0.0'). When provided, the server checks compatibility and attaches warnings if mismatched.","type":"string"},"schema_strict_mode":{"default":false,"description":"When true, schema incompatibility returns an error instead of a warning. Default: false (warn mode).","type":"boolean"},"dry_run":{"description":"Phase 1 dry_run: when true, SIMULATE the transaction without signing or submitting. Returns effects + events showing what WOULD happen — no on-chain state is modified, no gas is charged. Use this to verify that an operation will succeed before committing. The returned digest will be 'dry_run:<timestamp>' and objectChanges will be empty (simulation only).","type":"boolean"},"window_profile":{"description":"Time-window profile for trial runs (N8 ktt6 F-14 re-carving of the 'business windows are never test-compressed' ruling, 2026-11-04). 'production' (default): compressed time-window violations BLOCK publish exactly as before. 'test': compressed windows are ADMITTED so a disposable trial store can run its full lifecycle fast — R-TIME-PROFILE violations degrade to loud named disclosures, and the publish itself is BLOCKED on a real network (testnet/mainnet); point the trial at a local/dev chain (env.network='localnet'). Trial discipline: test-profile stores are throwaway — a production store must re-issue WITHOUT this flag (guards freeze at publish, so compressed windows are unrepairable except by rebuilding the store).","type":"string","enum":["production","test"]},"response_level":{"description":"Write-success response size. 'compact' (default) trims the structured result to key fields (digest + created object references); 'full' includes the complete raw result. Default: compact.","type":"string","enum":["compact","full"]},"confirm_mode":{"description":"Confirmation frequency for this call. 'full': confirm every matched gate rule. 'streamlined' (client default): skip fail-open 'standard' level prompts — fail-closed levels (irreversible/publish/amount) ALWAYS still confirm. 'quiet': same hard floor as streamlined, for clients that batch/suppress repeat low-risk prompts in their own UI. This field NEVER downgrades fail-closed levels.","type":"string","enum":["full","streamlined","quiet"]}},"required":["account","schema_strict_mode"],"additionalProperties":false,"description":"IMPORTANT: Execution environment includes: account for signing operations, network selection (testnet | localnet | mainnet), additional Guard permissions, and more. Used to specify context information during the call. If account is not specified, the default account (\"\") will be used. NOTE: by default the SDK auto-registers the sender in the global Entity table when absent (first business transaction; the account receives an owned Resource object). Set no_auto_register=true only on explicit user request."},"submission":{"type":"object","properties":{"type":{"type":"string","const":"submission","description":"Discriminator for this result variant. Constraint: always 'submission'. Example: 'submission'"},"guard":{"maxItems":20,"type":"array","items":{"type":"object","properties":{"object":{"type":"string","description":"Guard object name or ID to verify against. Example: 'my-delivery-guard' or '0x123...'"},"impack":{"type":"boolean","description":"Whether this Guard's verification result participates in the final logic. Constraint: if false, the Guard is checked but does not block the operation. Example: true"}},"required":["object","impack"],"additionalProperties":false},"description":"Array of Guard objects to verify. Constraint: at most 20 entries (MAX_GUARD_COUNT_PASSPORT). Relation: each entry corresponds to a Guard bound to the operation."},"submission":{"type":"array","items":{"type":"object","properties":{"guard":{"type":"string","description":"Guard object name or ID that requires submission data. Example: 'my-delivery-guard'"},"submission":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"integer","minimum":0,"maximum":255,"description":"Identifier (0-255) for data lookup in Guard table. Slot consensus (enforced on-chain at guard table construction): 0-220 = user slots (free for business guards); 221-253 = PROTOCOL-RESERVED (rejected on-chain — reserved so future protocol features get fixed slots without colliding with published guards); 255 = ONCE replay-protection slot on Allocation (byte-keyed, the submitted bytes are the once-key — use for per-period keys like period-<N>); 254 = ONCE-FOR-OBJECT slot on Allocation (chain-derived key = bcs(the Allocation's payment_info.for_object); the submitted bytes are ignored and the submission only arms the slot — use for one-shot per-order rails whose payee is NOT the order itself, such as settlement releases and incentive/bounty claims). NEVER arm 254 on a refund rail: a refund pays the submitted Order through user slot 0, and a refund leg re-entered in a later renewal period would abort E_ONCE_TRIGGERED (16) forever — refund once-ness comes from the terminal-node topology, never from a once slot. SLOT 0 SEMANTICS: slot 0 carries the transacted Order address by convention. As a submission slot it is legal on order/allocation/machine rails (the order exists when those verify), but FORBIDDEN on a Service buy_guard — the order does not exist when the buy-time passport is verified, so the mount is refused (service abort 43)."},"b_submission":{"type":"boolean","description":"Whether this table item's value is submitted dynamically at Guard trigger time (alloc_by_guard call). \n\ntrue = value is submitted by the caller when triggering the Guard. Use for runtime-context-dependent values like order address, user address. The 'value' field is ignored when b_submission=true; the caller must provide it via submissions[]. \n\nfalse = value is static, set at Guard creation time. Use for values known when the Guard is created: expected node names, expected merchant address, expected service address. The 'value' field must be populated and will be stored on-chain permanently. \n\nRule of thumb: if the value is the SAME for all future Guard triggers, use false. If the value DIFFERS per trigger (e.g., which order to release funds for), use true."},"value_type":{"description":"Type of the value stored in `value`. One of: Bool(0), Address(1), String(2), U8(3), U16(4), U32(5), U64(6), U128(7), U256(8), VecBool(9), VecAddress(10), VecString(11), VecU8(12), VecU16(13), VecU32(14), VecU64(15), VecU128(16), VecU256(17), VecVecU8(18). When value_type=Address (1), the `value` field accepts a hex address string, a LocalMark name, or an AccountOrMark_Address object — see `value` field description for details.","anyOf":[{"type":"number","const":0,"description":"Bool (0)"},{"type":"number","const":1,"description":"Address (1)"},{"type":"number","const":2,"description":"String (2)"},{"type":"number","const":3,"description":"U8 (3)"},{"type":"number","const":4,"description":"U16 (4)"},{"type":"number","const":5,"description":"U32 (5)"},{"type":"number","const":6,"description":"U64 (6)"},{"type":"number","const":7,"description":"U128 (7)"},{"type":"number","const":8,"description":"U256 (8)"},{"type":"number","const":9,"description":"VecBool (9)"},{"type":"number","const":10,"description":"VecAddress (10)"},{"type":"number","const":11,"description":"VecString (11)"},{"type":"number","const":12,"description":"VecU8 (12)"},{"type":"number","const":13,"description":"VecU16 (13)"},{"type":"number","const":14,"description":"VecU32 (14)"},{"type":"number","const":15,"description":"VecU64 (15)"},{"type":"number","const":16,"description":"VecU128 (16)"},{"type":"number","const":17,"description":"VecU256 (17)"},{"type":"number","const":18,"description":"VecVecU8 (18)"},{"type":"string","const":"Bool","description":"Bool"},{"type":"string","const":"Address","description":"Address"},{"type":"string","const":"String","description":"String"},{"type":"string","const":"U8","description":"U8"},{"type":"string","const":"U16","description":"U16"},{"type":"string","const":"U32","description":"U32"},{"type":"string","const":"U64","description":"U64"},{"type":"string","const":"U128","description":"U128"},{"type":"string","const":"U256","description":"U256"},{"type":"string","const":"VecBool","description":"VecBool"},{"type":"string","const":"VecAddress","description":"VecAddress"},{"type":"string","const":"VecString","description":"VecString"},{"type":"string","const":"VecU8","description":"VecU8"},{"type":"string","const":"VecU16","description":"VecU16"},{"type":"string","const":"VecU32","description":"VecU32"},{"type":"string","const":"VecU64","description":"VecU64"},{"type":"string","const":"VecU128","description":"VecU128"},{"type":"string","const":"VecU256","description":"VecU256"},{"type":"string","const":"VecVecU8","description":"VecVecU8"},{"type":"string","const":"bool","description":"bool"},{"type":"string","const":"address","description":"address"},{"type":"string","const":"string","description":"string"},{"type":"string","const":"u8","description":"u8"},{"type":"string","const":"u16","description":"u16"},{"type":"string","const":"u32","description":"u32"},{"type":"string","const":"u64","description":"u64"},{"type":"string","const":"u128","description":"u128"},{"type":"string","const":"u256","description":"u256"},{"type":"string","const":"vecbool","description":"vecbool"},{"type":"string","const":"vecaddress","description":"vecaddress"},{"type":"string","const":"vecstring","description":"vecstring"},{"type":"string","const":"vecu8","description":"vecu8"},{"type":"string","const":"vecu16","description":"vecu16"},{"type":"string","const":"vecu32","description":"vecu32"},{"type":"string","const":"vecu64","description":"vecu64"},{"type":"string","const":"vecu128","description":"vecu128"},{"type":"string","const":"vecu256","description":"vecu256"},{"type":"string","const":"vecvecu8","description":"vecvecu8"}]},"value":{"description":"The actual value data. Format depends on `value_type`:\nTYPE-CLASS SPLIT (F03): scalar value_types (Bool/Address/String/U8..U256) take ONE scalar value (boolean/address string/name/string/number); Vec* value_types (VecBool/VecAddress/VecString/VecU8..VecU256) take a REAL JSON ARRAY of elements — a string (even a Python-repr-looking \"[a, b]\") fails serialization with 'value_type=10 (array) requires a array value'. The historical 'static values must be strings' rule applied to SCALARS only.\n• Bool: true/false (boolean)\n• Address (CRITICAL — string 'Address' is NOT a placeholder): a hex address (e.g. '0x1234...'), a LocalMark name (e.g. 'my-service' — resolved to address at evaluation time), an AccountOrMark_Address object (e.g. {name_or_address:'my-service'}), or system shorthand ('0xaaa' = EntityLinker, '0xaab' = EntityRegistrar). The literal string 'Address' itself is INVALID — it would be treated as a non-existent LocalMark name and fail. Example: value='0x2::wow::WOW<address>' or value='my-permission'.\n• String: any string\n• U8/U16/U32/U64/U128/U256: number or numeric string (e.g. 42 or '42')\n• Vec* types: arrays of the corresponding element type\nPROTOCOL SLOT 254 (once, b_submission Address): the submitted value MUST be the ORDER address bound to the operation (payment_info.for_object) — NEVER the Progress/Machine/Arb object the call is advancing. The chain asserts submission(254) == the order address; a Progress address fails the task binding and the forward aborts.\nREQUIRED when b_submission=false. OPTIONAL when b_submission=true (value is supplied at evaluation time by user submission).","anyOf":[{"type":"boolean"},{"anyOf":[{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."},{"type":"string"}]},{"type":"string"},{"type":"number"},{"type":"array","items":{"type":"boolean"}},{"anyOf":[{"type":"object","properties":{"entities":{"minItems":1,"type":"array","items":{"type":"object","properties":{"name_or_address":{"type":"string","description":"Account/Object name or ID. If specifying an account, use empty string '' for the default account. If it starts with '0x', it will be treated as an ID. Otherwise, it will be treated as a name (max 64 bcs characters)."},"local_mark_first":{"description":"Whether to prioritize local marks, if true, prioritize local marks, otherwise prioritize global marks","type":"boolean"}},"additionalProperties":false,"description":"Account or address lookup object. Use this to specify which account to use for an operation. EXAMPLE: { name_or_address: 'testor2' } - looks up account by name; EXAMPLE: { name_or_address: '0x1234...' } - uses address directly; If name_or_address is empty string '', uses the default local account. name_or_address is REQUIRED — {} resolves to nothing useful and is rejected."}},"check_all_founded":{"default":true,"description":"Whether to check all entities are found. Defaults to true: abort and throw if ANY entity cannot be resolved. Set false only when partial resolution is explicitly intended (only found IDs are returned)","type":"boolean"}},"required":["entities","check_all_founded"],"additionalProperties":false,"description":"Used to batch find account or object IDs by name"},{"type":"array","items":{"type":"string"}}]},{"type":"array","items":{"type":"string"}},{"type":"array","items":{"type":"number"}},{"type":"array","items":{"type":"array","items":{"type":"number"}}}]},"name":{"default":"","description":"Data name identifier. MAX 64 BCS characters (Chinese chars count as 3-4 BCS bytes each). Use short identifiers like 'order_id', 'delivery_node'. Put longer descriptions in the Guard's 'description' field, NOT here.","type":"string"},"object_type":{"description":"OUTPUT-ONLY (query side): Object type when value_type is Address and represents a specific object. Auto-derived by the system — DO NOT set this field at Guard creation.","type":"string","enum":["Permission","Repository","Arb","Arbitration","Service","Machine","Order","Progress","Payment","Treasury","Guard","Demand","Passport","Allocation","Resource","Reward","Discount","EntityRegistrar","EntityLinker","Proof","WReceivedObject","Contact","TableItem_ProgressHistory","TableItem_PermissionPerm","TableItem_DemandPresenter","TableItem_MachineNode","TableItem_TreasuryHistory","TableItem_RepositoryData","TableItem_RewardRecord","TableItem_EntityLinker","TableItem_AddressMark","TableItem_EntityRegistrar"]}},"required":["identifier","b_submission","value_type","name"],"additionalProperties":false,"description":"Guard table item (QUERY/OUTPUT form — includes auto-derived object_type field)"},"description":"User-submitted data matching the Guard's required fields. Relation: structure must match the Guard table's column definitions. Example: [{field:'delivery_proof', value:'Qm...'}] PROTOCOL SLOT 254: when the Guard table has identifier 254, submit the ORDER address bound to the operation (payment_info.for_object) — never the Progress/Machine object being advanced."}},"required":["guard","submission"],"additionalProperties":false,"description":"One Guard's submission data: the Guard to verify plus the user-provided data that satisfies its requirements."},"description":"User-submitted data for each Guard. Relation: one entry per Guard in the guard array; fill submission fields and resubmit via call_with_submission. SLOT COMPLETENESS (T8 az3-mn-261013): the submission array must cover EVERY b_submission slot in the Guard's table, not just one — a Guard whose table has multiple b_submission entries (e.g. slot 0 + slot 254) aborts on-chain with 'Submission ID not found' (abort 11) when any b_submission slot has no matching entry. Check the Guard's table (each entry with b_submission needs its identifier filled) and include ALL of them. PLACEMENT: this `submission` field is at the SAME level as `data` and `env` in the operation input — NOT inside `data.data`. Example structure: {tool:'onchain_operations', data:{operation_type:'order', data:{object:'my_order', progress:{...}}}, submission:{type:'submission', guard:[...], submission:[...]}}"}},"required":["type","guard","submission"],"additionalProperties":false,"description":"Guard verification required. The operation was blocked because one or more Guards require user-submitted data. Fill the submission array and resubmit. Semantic status is 'pending_input'."}},"required":["operation_type","data"],"additionalProperties":false}